ChainedShark APT Group Targets China’s Research Sector with Sophisticated Attacks
- Securityish
- Threats & Incidents
Quick Summary
In 2025, NSFOCUS Fuying Lab identified the ChainedShark APT group, active since May 2024, targeting China’s scientific research sector. This group focuses on professionals in universities and research institutions specializing in international relations and marine technology, aiming to steal sensitive data. ChainedShark employs advanced social engineering tactics, including phishing emails disguised as conference invitations, and utilizes complex custom trojans like LinkedShell to execute their attacks.
The Securityish Brief
The ChainedShark APT group, tracked as Actor240820, was disclosed by NSFOCUS Fuying Lab in 2025. Active since May 2024, this group has targeted professionals in Chinese universities and research institutions, particularly those involved in international relations and marine technology. Their goal is to steal sensitive data and intelligence relevant to diplomacy and marine sciences.
ChainedShark’s operations are characterized by high strategic coherence and technical sophistication, employing advanced social engineering techniques. They craft fluent Chinese-language lures, exploiting professional scenarios such as conference invitations to lower the guard of their targets.
In their first wave of attacks in May 2024, ChainedShark deployed a custom trojan named LinkedShell, which featured advanced anti-forensic capabilities. This initial operation remains one of the most complex identified to date, showcasing the group’s robust weaponization capabilities.
Subsequent attacks from August to November 2024 saw the group adjusting their tactics. They exploited the GrimResource vulnerability, publicly disclosed in June 2024, to streamline their attack process, indicating a strategic shift towards leveraging public vulnerabilities for efficiency.
Analysis of the attacks revealed a consistent targeting pattern, with the same individuals being attacked across different timeframes. The phishing emails used in these attacks shared similarities in subject lines and social engineering tactics, forming a behavioral fingerprint that aids in attribution.
This correlation highlights the mature social engineering script and attack management process that ChainedShark adheres to throughout its campaigns, emphasizing the need for heightened awareness among potential targets.
Key Takeaways
- Be cautious of unexpected emails, especially those that appear to be from academic conferences or calls for papers.
- Verify the authenticity of any invitations or requests for information before responding.
- Implement robust email filtering to detect and block phishing attempts.
- Educate staff on recognizing social engineering tactics used in phishing attacks.
- Regularly update software and systems to protect against known vulnerabilities like GrimResource.
Key Terms & Concepts
- APT group: In this article, APT group refers to a sophisticated cyber threat actor that conducts prolonged and targeted attacks.
- LinkedShell: LinkedShell is a custom-developed trojan used by the ChainedShark group, known for its advanced anti-forensic capabilities.
- GrimResource vulnerability: GrimResource vulnerability is a publicly disclosed security flaw that ChainedShark exploited to enhance their attack efficiency.
Read the original article here: https://securityboulevard.com/2026/02/top-security-incidents-of-2025-the-emergence-of-the-chainedshark-apt-group/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
